From 6a005f7e5792c266f26fb0321f506ef41d447f79 Mon Sep 17 00:00:00 2001
From: Matt Mitchell <mmitche@microsoft.com>
Date: Wed, 9 Oct 2024 15:35:09 -0700
Subject: [PATCH] Fix NuGet audit errors and update to RC2 (#15153)

---
 eng/BuildTask.Packages.props                  |  3 +-
 eng/Version.Details.xml                       | 96 +++++++++----------
 eng/Versions.props                            | 29 +++---
 global.json                                   |  4 +-
 .../Sdk/tools/dotnet-cli/DotNetCli.props      |  2 +-
 5 files changed, 68 insertions(+), 66 deletions(-)

diff --git a/eng/BuildTask.Packages.props b/eng/BuildTask.Packages.props
index 1c2d2a72e5e..cd1bf0cc854 100644
--- a/eng/BuildTask.Packages.props
+++ b/eng/BuildTask.Packages.props
@@ -18,9 +18,10 @@
     <PackageVersion Update="Microsoft.Extensions.Logging.Console" Version="8.0.0" />
   </ItemGroup>
 
-  <!-- Suppress System.Text.Json/8.0.0 advisory as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.4). -->
+  <!-- Suppress System.Text.Json/8.0.0 and 8.0.4 advisories as desktop msbuild doesn't yet provide binding redirects for the non-vulnerable version (8.0.5). -->
   <ItemGroup>
     <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-hh2w-p6rv-4g7w" />
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-8g4q-xg66-9fp4" />
   </ItemGroup>
 
 </Project>
diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
index 9c78ba32057..717ba52bd65 100644
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@@ -64,45 +64,45 @@
     </Dependency>
     <!-- Necessary for source-build. The dependency is loaded in during built-time
          by consumers of NuGetRepack.Tasks, so we cannot use a ref pack for it -->
-    <Dependency Name="System.IO.Packaging" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="System.IO.Packaging" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.Bcl.AsyncInterfaces" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="Microsoft.Bcl.AsyncInterfaces" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
     <!-- Necessary for source-build. This allows the live version of the dependency
          to flow in and eliminates related prebuilts. -->
-    <Dependency Name="Microsoft.Extensions.DependencyInjection.Abstractions" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="Microsoft.Extensions.DependencyInjection.Abstractions" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
     <!-- Necessary for source-build. This allows the live version of the dependency
          to flow in and eliminates related prebuilts. -->
-    <Dependency Name="Microsoft.Extensions.DependencyInjection" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="Microsoft.Extensions.DependencyInjection" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
     <!-- Necessary for source-build. The dependency is loaded in during built-time
          by consumers of SharedFramework.Sdk (such as runtime), so we cannot use a ref pack for it -->
-    <Dependency Name="Microsoft.Extensions.DependencyModel" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="Microsoft.Extensions.DependencyModel" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.Extensions.FileProviders.Abstractions" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="Microsoft.Extensions.FileProviders.Abstractions" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.Extensions.FileSystemGlobbing" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="Microsoft.Extensions.FileSystemGlobbing" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
     <!-- Necessary for source-build. This allows the live version of the dependency
          to flow in and eliminates related prebuilts. -->
-    <Dependency Name="Microsoft.Extensions.Logging.Console" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="Microsoft.Extensions.Logging.Console" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
     <!-- Needed for when this dependency gets updated in 
          https://github.com/dotnet/source-build-externals, otherwise
@@ -111,13 +111,13 @@
       <Uri>https://github.com/JamesNK/Newtonsoft.Json</Uri>
       <Sha>0a2e291c0d9c0c7675d445703e51750363a549ef</Sha>
     </Dependency>
-    <Dependency Name="System.Text.Encodings.Web" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="System.Text.Encodings.Web" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
-    <Dependency Name="System.Text.Json" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="System.Text.Json" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
     <Dependency Name="Microsoft.Deployment.DotNet.Releases" Version="2.0.0-preview.1.24305.1" CoherentParentDependency="Microsoft.NET.Sdk.WorkloadManifestReader">
       <Uri>https://github.com/dotnet/deployment-tools</Uri>
@@ -146,9 +146,9 @@
       <SourceBuild RepoName="deployment-tools" ManagedOnly="true" />
     </Dependency>
     <!-- Intermediate is necessary for source build. -->
-    <Dependency Name="Microsoft.SourceBuild.Intermediate.runtime.linux-x64" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="Microsoft.SourceBuild.Intermediate.runtime.linux-x64" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
       <SourceBuild RepoName="runtime" ManagedOnly="false" />
     </Dependency>
     <!-- Intermediate is necessary for source build. -->
@@ -170,30 +170,30 @@
       <SourceBuild RepoName="source-build-reference-packages" ManagedOnly="true" />
     </Dependency>
     <!-- Transitive dependency needed for source build. -->
-    <Dependency Name="System.Collections.Immutable" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="System.Collections.Immutable" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
     <Dependency Name="System.CommandLine" Version="2.0.0-beta4.24126.1">
       <Uri>https://github.com/dotnet/command-line-api</Uri>
       <Sha>5ea97af07263ea3ef68a18557c8aa3f7e3200bda</Sha>
     </Dependency>
     <!-- Transitive dependency needed for source build. -->
-    <Dependency Name="System.Reflection.Metadata" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="System.Reflection.Metadata" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
-    <Dependency Name="System.Formats.Asn1" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="System.Formats.Asn1" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
-    <Dependency Name="System.Security.Cryptography.Pkcs" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="System.Security.Cryptography.Pkcs" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
-    <Dependency Name="System.Security.Cryptography.Xml" Version="9.0.0-preview.6.24327.7">
-      <Uri>https://github.com/dotnet/runtime</Uri>
-      <Sha>573461dc897731c11d6166574b77a8c3aabba220</Sha>
+    <Dependency Name="System.Security.Cryptography.Xml" Version="9.0.0-rc.2.24473.5">
+      <Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
+      <Sha>990ebf52fc408ca45929fd176d2740675a67fab8</Sha>
     </Dependency>
     <Dependency Name="Microsoft.DncEng.SecretManager" Version="1.1.0-beta.24503.1">
       <Uri>https://github.com/dotnet/dnceng</Uri>
diff --git a/eng/Versions.props b/eng/Versions.props
index 0bbbe3f755e..be8d5e5facb 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -44,13 +44,13 @@
     <MicrosoftCodeAnalysisCSharpVersion>4.8.0</MicrosoftCodeAnalysisCSharpVersion>
     <MicrosoftNetCompilersToolsetVersion>4.8.0</MicrosoftNetCompilersToolsetVersion>
     <!-- runtime -->
-    <MicrosoftBclAsyncInterfacesVersion>9.0.0-preview.6.24327.7</MicrosoftBclAsyncInterfacesVersion>
-    <MicrosoftExtensionsDependencyInjectionAbstractionsVersion>9.0.0-preview.6.24327.7</MicrosoftExtensionsDependencyInjectionAbstractionsVersion>
-    <MicrosoftExtensionsDependencyInjectionVersion>9.0.0-preview.6.24327.7</MicrosoftExtensionsDependencyInjectionVersion>
-    <MicrosoftExtensionsDependencyModelVersion>9.0.0-preview.6.24327.7</MicrosoftExtensionsDependencyModelVersion>
-    <MicrosoftExtensionsFileProvidersAbstractionsVersion>9.0.0-preview.6.24327.7</MicrosoftExtensionsFileProvidersAbstractionsVersion>
-    <MicrosoftExtensionsFileSystemGlobbingVersion>9.0.0-preview.6.24327.7</MicrosoftExtensionsFileSystemGlobbingVersion>
-    <MicrosoftExtensionsLoggingConsoleVersion>9.0.0-preview.6.24327.7</MicrosoftExtensionsLoggingConsoleVersion>
+    <MicrosoftBclAsyncInterfacesVersion>9.0.0-rc.2.24473.5</MicrosoftBclAsyncInterfacesVersion>
+    <MicrosoftExtensionsDependencyInjectionAbstractionsVersion>9.0.0-rc.2.24473.5</MicrosoftExtensionsDependencyInjectionAbstractionsVersion>
+    <MicrosoftExtensionsDependencyInjectionVersion>9.0.0-rc.2.24473.5</MicrosoftExtensionsDependencyInjectionVersion>
+    <MicrosoftExtensionsDependencyModelVersion>9.0.0-rc.2.24473.5</MicrosoftExtensionsDependencyModelVersion>
+    <MicrosoftExtensionsFileProvidersAbstractionsVersion>9.0.0-rc.2.24473.5</MicrosoftExtensionsFileProvidersAbstractionsVersion>
+    <MicrosoftExtensionsFileSystemGlobbingVersion>9.0.0-rc.2.24473.5</MicrosoftExtensionsFileSystemGlobbingVersion>
+    <MicrosoftExtensionsLoggingConsoleVersion>9.0.0-rc.2.24473.5</MicrosoftExtensionsLoggingConsoleVersion>
     <MicrosoftNETCorePlatformsVersion>5.0.0</MicrosoftNETCorePlatformsVersion>
     <MicrosoftNETRuntimeEmscripten2023Nodewin_x64>6.0.4</MicrosoftNETRuntimeEmscripten2023Nodewin_x64>
     <MicrosoftNETRuntimeEmscripten2023Pythonwin_x64>6.0.4</MicrosoftNETRuntimeEmscripten2023Pythonwin_x64>
@@ -64,14 +64,15 @@
     <MicrosoftNETWorkloadMonoToolChainManifest_60300Version_6022>6.0.22</MicrosoftNETWorkloadMonoToolChainManifest_60300Version_6022>
     <MicrosoftiOSTemplatesVersion>15.2.302-preview.14.122</MicrosoftiOSTemplatesVersion>
     <MicrosoftiOSTemplatesVersion160527>16.0.527</MicrosoftiOSTemplatesVersion160527>
-    <SystemCollectionsImmutableVersion>9.0.0-preview.6.24327.7</SystemCollectionsImmutableVersion>
+    <SystemCollectionsImmutableVersion>9.0.0-rc.2.24473.5</SystemCollectionsImmutableVersion>
     <SystemCompositionVersion>9.0.0-preview.6.24327.7</SystemCompositionVersion>
-    <SystemIOPackagingVersion>9.0.0-preview.6.24327.7</SystemIOPackagingVersion>
-    <SystemReflectionMetadataVersion>9.0.0-preview.6.24327.7</SystemReflectionMetadataVersion>
-    <SystemSecurityCryptographyXmlVersion>9.0.0-preview.6.24327.7</SystemSecurityCryptographyXmlVersion>
-    <SystemTextEncodingsWebVersion>9.0.0-preview.6.24327.7</SystemTextEncodingsWebVersion>
-    <SystemTextJsonVersion>9.0.0-preview.6.24327.7</SystemTextJsonVersion>
-    <SystemFormatsAsn1Version>9.0.0-preview.6.24327.7</SystemFormatsAsn1Version>
+    <SystemIOPackagingVersion>9.0.0-rc.2.24473.5</SystemIOPackagingVersion>
+    <SystemReflectionMetadataVersion>9.0.0-rc.2.24473.5</SystemReflectionMetadataVersion>
+    <SystemSecurityCryptographyPkcsVersion>9.0.0-rc.2.24473.5</SystemSecurityCryptographyPkcsVersion>
+    <SystemSecurityCryptographyXmlVersion>9.0.0-rc.2.24473.5</SystemSecurityCryptographyXmlVersion>
+    <SystemTextEncodingsWebVersion>9.0.0-rc.2.24473.5</SystemTextEncodingsWebVersion>
+    <SystemTextJsonVersion>9.0.0-rc.2.24473.5</SystemTextJsonVersion>
+    <SystemFormatsAsn1Version>9.0.0-rc.2.24473.5</SystemFormatsAsn1Version>
     <!-- sdk -->
     <MicrosoftNETSdkWorkloadManifestReaderVersion>9.0.100-preview.6.24328.19</MicrosoftNETSdkWorkloadManifestReaderVersion>
     <!-- source-build-externals -->
diff --git a/global.json b/global.json
index 87dbc2d8f03..9823f335f44 100644
--- a/global.json
+++ b/global.json
@@ -1,10 +1,10 @@
 {
   "sdk": {
-    "version": "9.0.100-rc.1.24452.12",
+    "version": "9.0.100-rc.2.24474.11",
     "rollForward": "latestFeature"
   },
   "tools": {
-    "dotnet": "9.0.100-rc.1.24452.12"
+    "dotnet": "9.0.100-rc.2.24474.11"
   },
   "msbuild-sdks": {
     "Microsoft.DotNet.Arcade.Sdk": "10.0.0-beta.24504.4",
diff --git a/src/Microsoft.DotNet.Helix/Sdk/tools/dotnet-cli/DotNetCli.props b/src/Microsoft.DotNet.Helix/Sdk/tools/dotnet-cli/DotNetCli.props
index 10b48e2eb9a..aa87be492d6 100644
--- a/src/Microsoft.DotNet.Helix/Sdk/tools/dotnet-cli/DotNetCli.props
+++ b/src/Microsoft.DotNet.Helix/Sdk/tools/dotnet-cli/DotNetCli.props
@@ -3,7 +3,7 @@
 
   <PropertyGroup>
     <IncludeDotNetCli Condition=" '$(IncludeDotNetCli)' != 'true' ">false</IncludeDotNetCli>
-    <AspNetCoreRuntimeVersion>9.0.0-rc.1.24452.1</AspNetCoreRuntimeVersion>
+    <AspNetCoreRuntimeVersion>9.0.0-rc.2.24474.3</AspNetCoreRuntimeVersion>
     <DotNetCliPackageType Condition=" '$(DotNetCliPackageType)' == '' ">runtime</DotNetCliPackageType>
     <DotNetCliVersion Condition=" '$(DotNetCliVersion)' == '' AND '$(DotNetCliPackageType)' == 'runtime' ">$(BundledNETCoreAppPackageVersion)</DotNetCliVersion>
     <!-- TODO (https://github.com/dotnet/arcade/issues/7022): We are hardcoding this version to use the one tied to the SDK version from global.json -->